updated the CSRF documentation